RMA Generator Fails Due to Missing Required config

[thievo552000]

Summary

The rma_config generator (rma_playbook_config_generator) fails on every run with missing required arguments: config, while all other 28 generators succeed. Root cause is an input-validation gap in the MCP generator wrapper, not a timeout or Catalyst Center issue.

---

Failure Flow

flowchart TD
    A[Client calls rma_config<br/>no filter provided] --> B[MCP wrapper _generator_tool<br/>server.py]
    B --> C["module_args = {}<br/>only sets state=gathered"]
    C --> D[_validate_module_args<br/>checks only PRESENT keys]
    D -->|config missing but<br/>NOT checked| E[Submits to ansible-runner]
    E --> F[Ansible builds playbook.yml<br/>without config:]
    F --> G[Ansible validates argument_spec]
    G --> H["config required=True<br/>but absent"]
    H --> I["FAIL: missing required arguments: config<br/>after ~30s wasted run"]

    style D fill:#ffe0e0
    style I fill:#ffd0d0

Loading

---

Where the Bug Is

The gap: MCP validation only checks present keys

File: server.py — function _validate_module_args

def _validate_module_args(module_name, module_args):
    ...
    allowed_keys = list(options.keys())
    for key, value in module_args.items():   # only iterates EXISTING keys
        option_schema = options.get(key)
        ...
    # MISSING: no check for "required field absent"
    #          -> RMA's required config slips through

The wrapper passes module_args = {} (server.py) and the validator never flags the missing required config. The failure only surfaces later inside Ansible.

Why only RMA fails — verified across all modules

Module	config required	Result
site, discovery, inventory, tags, accesspoint, wireless_design, ... (28 modules)	False	Pass — empty config = "export all"
rma	True (both DOCUMENTATION line 60 AND argument_spec line 1812)	Fail

RMA intentionally requires config because it needs to know which device is faulty and which is the replacement — "export all RMA" has no meaning. This is a correct module design, not a typo.

---

Why Fix in MCP (not Ansible)

Criteria	Fix in Ansible module	Fix in MCP
Ownership	Third-party Cisco collection; lost on reinstall	Our own repo
Design correctness	RMA intentionally requires config — making it optional is wrong	MCP is the input-validation layer
Performance	Must run full ~30s playbook before failing	Fails instantly, no wasted run

The module's contract says config is required. MCP should honor that contract by enforcing it at the boundary.

---

Proposed Fix (Option A — fail-fast)

Add a required-field check to _validate_module_args in server.py:

# After the existing key-iteration loop:
missing_required = [
    key for key, schema in options.items()
    if isinstance(schema, dict)
    and schema.get("required") is True
    and key not in module_args
]
if missing_required:
    raise HTTPException(
        status_code=400,
        detail=(
            f"Module {module_name} requires field(s): "
            f"{', '.join(missing_required)}. "
            f"Provide them via module_args_json. See meta.workflowSpec."
        ),
    )

Benefits:

• rma_config without a filter returns an immediate, clear 400 error instead of an opaque Ansible failure after 30s.
• Reads required dynamically from meta.workflowSpec → automatically protects any future module with required fields, not just RMA.

Rejected alternative (Option B): Auto-inject config: [{}]. Not recommended — it produces empty/meaningless data and hides the user's true intent. RMA needs a real filter to be useful.

---

Impact / Severity

• Severity: Low-Medium (1 of 29 generators; no data corruption)
• User impact: Confusing failure with no actionable message
• Scope: Only affects modules with config: required=True (currently just RMA)
• Not related to: timeouts, MCP orchestration, or Catalyst Center API — those worked correctly.